> Source: [sk178668](https://support.checkpoint.com/results/sk/sk178668)
# sk178668 - Cloud Firewall for Public Cloud solutions - Overview
| Property | Value |
|----------|-------|
| Solution ID | sk178668 |
| Date Created | 2022-04-24 |
| Last Modified | 2026-10-04 |
| Technical Level | General |
| Products | Cloud Firewall |
| Versions | R82.10, R81.10 (EOS), R81.20, R82 |
| OS | Gaia |
| Platform | AWS, Azure, Alibaba Cloud, GCP, OCI |
## Solution
This article provides a comprehensive overview of deploying Check Point Cloud Firewall solutions across different cloud platforms like AWS, Azure, Google Cloud, Oracle Cloud, and Alibaba Cloud. Depending on your use case, you can leverage different deployment options to ensure optimal security and performance for your cloud infrastructure.
When ready to deploy, see the "Deployment options" section at the bottom.
**Table of Contents:**
* Recommended solutions
* Recommended solutions for VPN connectivity
* Full solutions list
* Deployment options
* Glossary
### Recommended solutions {#Recommended solutions}
|----------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Platform | Solution | Best for | Links |
| **** **Azure** | Virtual WAN [](https://sc1.checkpoint.com/documents/IaaS/WebAdminGuides/EN/CP_CloudGuard_Network_for_Azure_vWAN/Default.htm) | Ideal for centralizing branch connectivity into a single inspection point. Useful for multi-branch environments requiring secure connectivity through VPN and ExpressRoute to cloud assets. | |-------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------| |  | [Deployment Guide](https://sc1.checkpoint.com/documents/IaaS/WebAdminGuides/EN/CP_CloudGuard_Network_for_Azure_vWAN/Default.htm) | |  | [Marketplace template](https://portal.azure.com/#view/Microsoft_Azure_Marketplace/SolutionFinder.ReactView/term/Cloud%20Firewall) | |  | [Terraform module](https://registry.terraform.io/modules/CheckPointSW/cloudguard-network-security/azure/latest) | |
| **** **Azure** | VMSS | Protects assets with dynamic traffic loads through traffic balancing across multiple instances and availability zones. Ideal for non-static workloads that do not require stateful failover or VPN support. | |-------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------| |  | [Deployment Guide](https://sc1.checkpoint.com/documents/IaaS/WebAdminGuides/EN/CP_VMSS_for_Azure/Default.htm) | |  | [Marketplace template](https://portal.azure.com/#view/Microsoft_Azure_Marketplace/SolutionFinder.ReactView/term/Cloud%20Firewall) | |  | [Terraform module](https://registry.terraform.io/modules/CheckPointSW/cloudguard-network-security/azure/latest) | |
| **** **AWS** | Gateway Load Balancer (GWLB) | Provides centralized security for cloud assets with dynamic scalability. Best for meeting variable load requirements and using a hub-and-spoke topology. Offers transparent security without special routing or NAT. | |------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| |  | [Deployment Guide](https://sc1.checkpoint.com/documents/IaaS/WebAdminGuides/EN/CP_CloudGuard_Network_for_AWS_Gateway_Load_Balancer_ASG/Content/Topics-AWS-GWLB-ASG-DG/Introduction.htm) | |  | [CloudFormation template](https://support.checkpoint.com/results/sk/sk111013) | |  | [Terraform module](https://registry.terraform.io/modules/CheckPointSW/cloudguard-network-security/aws/latest) | |
| **** **AWS** | Transit Gateway Autoscaling | For workloads with highly dynamic load patterns. It supports automatic scaling to handle fluctuating traffic. | |------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| |  | [Deployment Guide](https://sc1.checkpoint.com/documents/IaaS/WebAdminGuides/EN/CP_CloudGuard_AWS_AutoScale_with_Transit_Gateway/Content/Topics-AWS-AutoScale-TGW-DG/Introduction.htm) | |  | [CloudFormation template](https://support.checkpoint.com/results/sk/sk111013) | |  | [Terraform module](https://registry.terraform.io/modules/CheckPointSW/cloudguard-network-security/aws/latest) | |
| **** **GCP** | NSI | GCP Network Security Integration enables third-party network appliances to inspect network traffic transparently, using packet intercept technology. | |---------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------| |  | [Deployment Guide](https://sc1.checkpoint.com/documents/IaaS/WebAdminGuides/EN/CP_CloudGuard_Network_for_GCP_NSI_AG/Default.htm) | |  | [Marketplace template](https://console.cloud.google.com/marketplace/browse?q=Cloud%20Firewall) | |  | [Terraform templates](https://registry.terraform.io/modules/CheckPointSW/cloudguard-network-security/gcp/latest) | |
| **** **GCP** | MIG | Google Cloud's managed instance groups are suited for dynamic scaling in response to traffic spikes. | |---------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------| |  | [Deployment Guide](https://sc1.checkpoint.com/documents/IaaS/WebAdminGuides/EN/CP_CloudGuard_Network_for_GCP_Autoscaling_MIG/Default.htm) | |  | [Marketplace template](https://console.cloud.google.com/marketplace/browse?q=Cloud%Firewall) | |  | [Terraform templates](https://registry.terraform.io/modules/CheckPointSW/cloudguard-network-security/gcp/latest) | |
| ** **OCI**** | High Availability (with Dynamic Routing Gateway) | Oracle Cloud's Dynamic Routing Gateway is the preferred technology for Hub \& Spoke connectivity. | |-------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| |  | [Deployment Guide](https://sc1.checkpoint.com/documents/IaaS/WebAdminGuides/EN/CP_CloudGuard_Network_for_Oracle_Cloud_Getting_Started/Content/Topics-Oracle-GS/Introduction.htm) | |  | [Reference Architecture](https://support.checkpoint.com/results/sk/sk176863) | |  | [Oracle Stack (Terraform)](https://cloudmarketplace.oracle.com/marketplace/en_US/listing/82219174) | |
| ** **OCI**** | Autoscaling | Autoscaling support for all traffic flows (except VPN) | |-------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| |  | [Deployment Guide](https://sc1.checkpoint.com/documents/IaaS/WebAdminGuides/EN/CP_CloudGuard_Network_for_OCI_Autoscaling_Instance_Pool_DeploymentGuide/Content/Topics-Oracle-Autoscaling-DG/Overview.htm) | |  | [Oracle Stack (Terraform)](https://cloudmarketplace.oracle.com/marketplace/en_US/listing/182995522) | |
| **** **AliCloud** | Gateway Load Balancer (GWLB) | Alibaba Cloud Gateway Load Balancer gives you a framework to integrate third-party security solutions, such as Check Point Cloud Firewall. | |-------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| |  | [Deployment Guide](https://sc1.checkpoint.com/documents/IaaS/WebAdminGuides/EN/CP_Cloud_Firewall_for_Alibaba_Cloud_Gateway_Load_Balancer_AdminGuide/Content/Topics-Alibaba-GWLB-AG/Introduction.htm) | |  | [Terraform templates](https://registry.terraform.io/modules/CheckPointSW/cloudguard-network-security/alibaba/latest) | |
##### [](https://sc1.checkpoint.com/documents/IaaS/WebAdminGuides/EN/CP_Azure_VMSS_GWLB/Default.htm)
##### [](https://sc1.checkpoint.com/documents/IaaS/WebAdminGuides/EN/CP_CloudGuard_Network_for_AWS_Gateway_Load_Balancer_ASG/Default.htm)
### Recommended solutions for VPN connectivity {#VPN connectivity}
|----------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---|
| Platform | Solution | Best for | Links |
| **** **Azure** | High Availability | Protecting static workloads requiring High Availability (HA) with redundancy across multiple availability zones, supporting stateful failover and VPN connectivity. | |-------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------| |  | [Deployment Guide](https://sc1.checkpoint.com/documents/IaaS/WebAdminGuides/EN/CP_CloudGuard_Network_for_Azure_HA_Cluster/Content/Topics-Azure-HA/Introduction.htm) | |  | [Marketplace template](https://portal.azure.com/#view/Microsoft_Azure_Marketplace/SolutionFinder.ReactView/term/Cloud%20Firewall) | |  | [Terraform module](https://registry.terraform.io/modules/CheckPointSW/cloudguard-network-security/azure/latest) | |
| **** **AWS** | Cross-AZ Cluster[](https://sc1.checkpoint.com/documents/IaaS/WebAdminGuides/EN/CP_CloudGuard_for_AWS_Cross_AZ_Cluster/Default.htm) | Protecting static workloads requiring High Availability (HA) with redundancy across multiple availability zones, supporting stateful failover and VPN connectivity. | |------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------| |  | [Deployment Guide](https://sc1.checkpoint.com/documents/IaaS/WebAdminGuides/EN/CP_CloudGuard_for_AWS_Cross_AZ_Cluster/Default.htm) | |  | [CloudFormation template](https://support.checkpoint.com/results/sk/sk111013) | |  | [Terraform module](https://registry.terraform.io/modules/CheckPointSW/cloudguard-network-security/aws/latest) | |
| **** **GCP** | High Availability[](https://sc1.checkpoint.com/documents/IaaS/WebAdminGuides/EN/CP_CloudGuard_Network_for_GCP_HA_Cluster/Default.htm) | Protecting static workloads requiring High Availability (HA) with redundancy across multiple availability zones, supporting stateful failover and VPN connectivity. | |---------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------| |  | [Deployment Guide](https://sc1.checkpoint.com/documents/IaaS/WebAdminGuides/EN/CP_CloudGuard_Network_for_GCP_HA_Cluster/Default.htm) | |  | [Marketplace template](https://console.cloud.google.com/marketplace/browse?q=Cloud%20Firewall) | |  | [Terraform templates](https://registry.terraform.io/modules/CheckPointSW/cloudguard-network-security/gcp/latest) | |
| **OCI** | High Availability | Protecting static workloads requiring High Availability (HA) with redundancy across multiple availability zones, supporting stateful failover and VPN connectivity. | |-------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| |  | [Deployment Guide](https://sc1.checkpoint.com/documents/IaaS/WebAdminGuides/EN/CP_CloudGuard_Network_for_Oracle_Cloud_Getting_Started/Content/Topics-Oracle-GS/Introduction.htm) | |  | [Oracle Stack (Terraform)](https://cloudmarketplace.oracle.com/marketplace/en_US/listing/82219174) | | |
| **** **AliCloud** | High Availability | Protecting static workloads requiring High Availability (HA) with redundancy across multiple availability zones, supporting stateful failover and VPN connectivity. | |-------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| |  | [Deployment Guide](https://sc1.checkpoint.com/documents/IaaS/WebAdminGuides/EN/CloudGuard_Network_for_Alibaba_Cloud_Cluster_DeploymentGuide/Content/Topics-Alibaba-Cluster-DG/Introduction.htm) | |  | [Terraform templates](https://registry.terraform.io/modules/CheckPointSW/cloudguard-network-security/alibaba/latest) | | |
### Deployment options {#Deployment options}
Cloud Firewall solutions are available for deployment using several options. Read the review below:
|----------------------------------|------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Deployment type | Recommended for | Available on | Link |
| **Marketplace** | Easy and guided deployment through the respective cloud marketplace. It is ideal for those looking for a straightforward setup. | Azure | [Cloud Firewall on Azure marketplace](https://portal.azure.com/#view/Microsoft_Azure_Marketplace/SolutionFinder.ReactView/term/Cloud%20Firewall) |
| **Marketplace** | Easy and guided deployment through the respective cloud marketplace. It is ideal for those looking for a straightforward setup. | Google Cloud | [Cloud Firewall on Google Cloud marketplace](https://console.cloud.google.com/marketplace/browse?q=Cloud%20Firewall) |
| **CloudFormation (CFT)** | Cloud-native deployment provisioning and management. Perfect for configuring multiple resources using platform-specific templates. | AWS | [Cloud Firewall for AWS CloudFormation templates](https://support.checkpoint.com/results/sk/sk111013) |
| **Azure Resource Manager (ARM)** | Cloud-native deployment provisioning and management. Perfect for configuring multiple resources using platform-specific templates. | Azure | [Cloud Firewall for Azure ARM Templates](https://github.com/CheckPointSW/CloudGuardIaaS/tree/master/azure/templates) |
| **Terraform** | Automating infrastructure tasks across multi-cloud environments. Best for automating deployment, provisioning, and management. | Azure, Google Cloud, AWS, Oracle Cloud, Ali Cloud | [Cloud Firewall Terraform modules for Azure, AWS, GCP, and AliCloud](https://registry.terraform.io/modules/CheckPointSW/cloudguard-network-security/) [Cloud Firewall Stacks for OCI (Terraform)](https://sc1.checkpoint.com/documents/IaaS/WebAdminGuides/EN/CP_CloudGuard_Network_for_Oracle_Cloud_Getting_Started/Default.htm) |
### Glossary {#Glossary}
Show / Hide this section
* **Standalone** - A solution in which the Cloud Firewall Gateway and the Security Management run in one instance.
* **Transit Gateway** - AWS Transit Gateway connects your Amazon Virtual Private Clouds (VPCs) and on-premises networks through a central hub.
* **GWLB** - Gateway Load Balancer (GWLB) is?a managed AWS service that allows you to insert third-party firewall appliances into the data path.
* **Virtual WAN** - A cloud networking service that connects Azure regions, on-premises sites, remote users, branch offices, and other clouds.
* **VMSS** - Azure Virtual Machine Scale Sets (VMSS) let you create and manage a group of load-balanced VMs
* **Autoscale** - Allows operating apps on multiple identical VMs enabling automatic scalability and high availability
* **MIG** - Allows operating apps on multiple identical VMs enabling automatic scalability and high availability
* **NSI** - Provides a framework for integrating third-party security solutions to inspect network traffic transparently, using packet intercept technology
* **CFT** - CloudFormation Template are AWS infrastructure as code (IAC) service allows definition and provisioning of AWS infrastructure resources using templates
* **ARM** - Azure Resource Manager (ARM) is the native platform for infrastructure as code (IaC) in Azure. It enables you to centralize the management, deployment, and security of Azure resources
* **Cluster** - A set of more than one Cloud Firewall Gateway working in partnership to provide High Availability (HA) solution.
* **HA** - The ability to overcome critical issues to some of the environment without impacting service availability
* **Stateful failover** - Stateful failover?ensures that traffic can continue without interruption. This is achieved by mirroring session state and persistence data across the Cloud Firewall Gateways in the cluster.
* **DRG**- Dynamic Routing Gateway in OCI allows for various network connections from a variety of sources.
### Full solutions list {#Full solutions list}
Show / Hide this section
|--------------|------------------------------|-------------------------------------|------------|--------------|----------|--------|----------|--------|--------------------|
| Platform | Solution | Use Case | Redundancy | Stateful F/O | Scalable | VPN | Cross-AZ | Blades | Supported Versions |
| **Azure** | Standalone | POC | No | No | No | Yes | No | Yes | R81.10 and higher |
| **Azure** | Single Gateway | Limited budget | No | No | No | Yes | No | Yes | R81.10 and higher |
| **Azure** | Cluster | VPN | Yes | Yes^1^ | No | Yes | Yes | Yes | R81.10 and higher |
| **Azure** | VMSS | Dynamic Load | Yes | No | Yes | Yes^2^ | Yes | Yes^2^ | R81.10 and higher |
| **Azure** | Gateway Load Balancer | Hub \& Spoke | Yes | No | No | No | Yes | Yes^2^ | R81.10 and higher |
| **Azure** | Virtual WAN | Simplified Hub \& Spoke | Yes | No | No | Yes^6^ | Yes | Yes | R81.10 and higher |
| **AWS** | Standalone | POC | No | No | No | Yes | No | Yes | R81.10 and higher |
| **AWS** | Single Gateway | Limited budget | No | No | No | Yes | No | Yes | R81.10 and higher |
| **AWS** | Cluster | VPN | Yes | Yes | No | Yes | No | Yes | R81.10 and higher |
| **AWS** | Geo Cluster | High Availability | Yes | No | No | No | Yes | Yes^3^ | R81.10 and higher |
| **AWS** | Cross-AZ Cluster | High Availability \& VPN | Yes | Yes | No | Yes | Yes | Yes | R81.20 and higher |
| **AWS** | Autoscale | Dynamic Load | Yes | No | Yes | No | Yes | Yes^4^ | R81.10 and higher |
| **AWS** | Transit Gateway Autoscaling | Hub \& Spoke with Dynamic Load | Yes | No | Yes | No | Yes | Yes^4^ | R81.10 and higher |
| **AWS** | Gateway Load Balancer (GWLB) | Hub \& Spoke with Dynamic Load | Yes | No | Yes | No | Yes | Yes^4^ | R81.20 and higher |
| **AWS** | Transit Gateway Geo Cluster | Hub \& Spoke with High Availability | Yes | No | No | No | Yes | Yes^3^ | R81.10 and higher |
| **AWS** | Gateway Load Balancer | Hub \& Spoke | Yes | No | No | No | Yes | Yes^4^ | R81.20 and higher |
| **GCP** | Standalone | POC | No | No | No | Yes | No | Yes | R81.10 and higher |
| **GCP** | Single Gateway | Limited budget | No | No | No | Yes | No | Yes | R81.10 and higher |
| **GCP** | Cluster | VPN | Yes | Yes | No | Yes | Yes | Yes^5^ | R81.10 and higher |
| **GCP** | NSI | Dynamic Load | Yes | No | Yes | No | Yes | Yes^4^ | R81.20 and higher |
| **GCP** | MIG | Dynamic Load | Yes | No | Yes | No | Yes | Yes^4^ | R81.10 and higher |
| **OCI** | High Availability | Hub \& Spoke \| VPN | Yes | Yes | No | Yes | Yes | Yes | R81.10 and higher |
| **OCI** | Autoscaling | Dynamic Load | Yes | No | Yes | No | Yes | Yes | R81.20 and higher |
| **AliCloud** | Single Gateway | Limited budget | No | No | No | Yes | No | Yes | R81.20 and higher |
| **AliCloud** | Cluster | VPN | Yes | Yes | No | Yes | No | Yes | R81.20 and higher |
| **AliCloud** | Gateway Load Balancer (GWLB) | Hub \& Spoke with Dynamic Load | Yes | No | Yes | No | Yes | Yes^4^ | R81.20 and higher |
^1^ Failover may take up to 2 minutes
^2^ Site To Site VPN and Mobile Access are not supported
^3^ Site To Site VPN, Remote Access, Mobile Access, Identity Awareness, Data Loss Prevention and Content Awareness are not supported
^4^ Site To Site VPN, Remote Access and Mobile Access are not supported
^5^ Remote Access VPN is not supported
^6^ Site To Site VPN with the Virtual WAN Hub VPN Gateway
---
# Agent Instructions
This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.
## Navigating This Knowledge Base
- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content